178. Regulation of the President of the National Council on the technical requirements to be met in the transmission and distribution of documents, documents, reports, information and communications on projects within the framework of the European Union, and their labelling in order to safeguard confidentiality (EU classified information-EU-VS-VO)

Pursuant to Section 7 (1) of Annex 2 to the Law on the Rules of Procedure 1975, BGBl. N ° 410, as last amended by the Federal Law BGBl. I No 31/2013, shall be arranged:

Scope

§ 1. (1) This Regulation shall apply to the administrative affairs of the institutions of the federal legislation.

(2) Where reference is made to federal legislation in this Regulation, these are to be applied in their respectively applicable version.

EU classified information, definitions

§ 2. (1) EU classified information within the meaning of this Regulation shall be all documents, documents, reports, information and communications on projects within the framework of the European Union with an EU classification, the unauthorised disclosure of which shall be subject to the interests of the European Union, or one or more of its Member States, to varying degrees.

(2) EU classified information shall be classified in one of the following levels of classification:

1.		Restreint UE/EU Restricted: documents, documents, reports, information and communications on projects within the framework of the European Union, the unauthorised disclosure of which is intended for the essential interests of the European Union, or of one or more of its Member States may be adversely affected.
2.		Confidentiel UE/EU Confidential: documents, documents, reports, information and communications on projects within the framework of the European Union, the unauthorised disclosure of which is the essential interests of the European Union or of one or more of its Member States could harm them.
3.		Secret UE/EU Secret: Documents, documents, reports, information and communications on projects within the framework of the European Union, the unauthorised disclosure of which is the essential interests of the European Union or of one or more of its Member States that could cause serious damage.
4.		Très Secret UE/EU Top Secret: Documents, documents, reports, information and communications on projects within the framework of the European Union, the unauthorised disclosure of which is the essential interests of the European Union or of one or more of its Could cause extremely serious damage to Member States.

(3) According to § 3 of the EU Information Act, Federal Law Gazette (BGBl), created by Austrian institutions, the National Council and the Bundesrat. I No 113/2011, documents are to be treated as those EU classified information to which they refer.

(4) For the terms "processing", "owner", "downgrading" and "publisher", the definitions in Annex A to the Council Decision of 31 March 2011 on the safety rules for the protection of EU classified information (2011/292/EU) shall apply.

Access to EU classified information

§ 3. (1) Access to EU classified information may only be granted to persons who have been shown to have been informed in accordance with § 4 on the handling of EU classified information; and

1.		are authorized to do so in accordance with the provisions of Annex 2 to the 1975 Act of Procedure, or
2.		for which access to the performance of their service duties is required and a security check in accordance with § § 55 to 55b Security Police Act, BGBl. No 566/1991.

(2) The persons who actually have access to EU classified information of the "Confidentiel UE/EU Confidential" classification or higher, as well as the date of the respective access, shall be kept in accordance with the relevant records.

Security documentation

§ 4. (1) The safety instruction shall be used to raise awareness of the threats to the security of EU classified information and shall ensure that the safety standards laid down are complied with in compliance with EU rules. It shall be made in writing prior to the opening of access to EU classified information and shall, in any event, be at the beginning of each legislative period of the National Council and, in the event of a modification or addition to the relevant provisions and obligations, to repeat.

(2) In the case of staff members of the Parliament's Directorate, the security instruction shall also include the obligation to take into account the secrecy of the office and the penalties to be applied in the event of their breach.

(3) The proof of security instruction shall be recorded in writing.

Establishment of protected areas

§ 5. In order to ensure the physical protection of EU classified information, the following protected areas shall be set up:

1.		Administrative areas: Areas of visible external demarcation to enable the control of persons who may only be entered unaccompanied by those persons who have received an authorisation. In the case of all other persons, constant monitoring by an authorised person or equivalent control shall be ensured.
2.		Particularly protected areas: areas with visible and protected demarcation with complete entry and exit control, which may only be entered by specially authorised persons or persons checked for safety. In the case of all other persons, constant monitoring shall be ensured by means of a person specially authorised or under security or equivalent control.
3.		Particularly protected area with interception protection: area which is additionally technically secured. Unauthorised communication links or electronic equipment or communication equipment shall be prohibited. Regular inspections and technical inspections shall be carried out.

Storage and processing

§ 6. (1) EU classified information shall be kept in locked containers in accordance with the level of secrecy in question. The storage of EU classified information shall be carried out

1.		the classification "Restreint UE/EU Restricted" in the administrative area or particularly protected area in a suitable, lockable office furniture,
2.		the classification "Confidentiel UE/EU Confidential" and "Secret UE/EU Secret" in the specially protected area in a security container or vault;
3.		of the "Très Secret UE/EU Top Secret" classification in the particularly protected area in
a)			a security container with permanent surveillance or inspection or with an approved burgling alarm system in connection with standby personnel in the security service, or
b)			a vault equipped with an emergency alarm system in connection with standby staff in the security service.

(2) EU classified information of the "Restreint UE/EU Restricted" classification may also be kept outside the protected areas for a limited period if the transport is carried out in a packaging which does not draw any conclusions on the Content allows, and the owner guarantees a security standard as in the protected areas according to § 4.

(3) The processing of EU classified information shall, in principle, be carried out in protected areas, with the processing of EU classified information

1.		up to the "Secret UE/EU Secret" classification in the administrative area, provided that they are protected from access by unauthorized persons,
2.		of the "Très Secret UE/EU Top Secret" classification is carried out exclusively in the specially protected area.

(4) EU classified information up to the "Secret UE/EU Secret" classification may be processed outside the protected areas, if:

1.		the transport is carried out in a packaging which does not allow any conclusions to be drawn to the content, and the owner, in accordance with § 4, guarantees a safety standard as in the protected areas, as well as
2.		in the case of EU classified information, "Confidentiel UE/EU Confidential" and "Secret UE/EU Secret", the owner keeps the EU classified information under personal control at any time, and the registry of the processing outside the protected Areas have been informed.

Registration

§ 7. (1) EU classified information such as "Confidentiel UE/EU Confidential", "Secret UE/EU Secret" and "Très Secret UE/EU Top Secret" are to be registered. For this purpose, a registry is to be set up as a particularly protected area.

(2) The registration shall be carried out in commercial books intended for this purpose, which shall be distinguished according to classification levels and shall be used exclusively for EU classified information within the meaning of this Regulation. Business books for EU classified information "Confidentiel UE/EU Confidential" and "Secret UE/EU Secret" are at least with the classification "Restreint UE/EU Restricted", business books for EU classified information of the EU "Très Secret UE/EU Top Secret" shall be classified as "Secret UE/EU Secret" classification.

(3) The registration of an EU classified information subject to registration as well as its reproduction, translation, distribution, return, downgrading, release and destruction must be registered.

(4) Each EU classified information subject to registration is to be provided with its own business number. In any case, the date of receipt, the publisher, the subject matter and the classification, the respective number of the copy, the name of the consignee and the date of transmission, return, downgrading, release and destruction shall be recorded.

(5) In the case of a downgrade, the registration in the business books of both the current and the new classification shall be effected. Recipients of a registered EU classified information shall be informed of the downgrading or release.

(6) Where EU classified information of the "Très Secret UE/EU Top Secret" classification is transmitted by a body other than the Central Registry in the Federal Ministry for European and International Affairs, such classified information shall be immediately available to the demonstrably to be informed.

Copies and translations

§ 8. (1) Copies and translations of EU classified information of the classification "Confidentiel UE/EU Confidential" or above may only be made by the registry in specially protected areas. The production of copies and translations of EU classified information "Très Secret UE/EU Top Secret" is only permitted with the prior written consent of the publisher.

(2) Each copy shall be marked as such and to be individualized by the respective number of the copy.

(3) On each copy or translation, the date, number of business and the publisher, as well as on each page, shall be affixed to the degree of classification, a page numbering and the respective number of the copy.

(4) If a marking in accordance with paragraphs 2 and 3 is not possible in individual cases, other appropriate measures for labelling shall be applied after the registration of the registral responsible.

(5) The provisions applicable to the original of an EU classified information shall apply to copies and translations.

Distribution and promotion

§ 9. (1) The distribution of EU classified information of the classification "Restreint UE/EU Restricted" shall be carried out by the databases in accordance with Article 2 (2) and (3) of the EU Information Act iVm § 3 Z 3 of Annex 2 to the Law on the Rules of Procedure of 1975.

(2) The distribution of EU classified information of the degree of classification "Confidentiel UE/EU Confidential" or higher shall be carried out by the Registry.

(3) EU classified information of the "Confidentiel UE/EU Confidential" classification shall be handed over against receipt of the acknowledgement. The transmission shall be carried out by persons authorised to maintain the classification in question.

(4) For transport within the buildings belonging to Parliament, EU classified information is to be packaged up to the level of "Secret UE/EU Secret" in such a way that no conclusions can be drawn about its contents. EU classified information "Très Secret UE/EU Top Secret" shall be carried in a secured envelope, only the name of the recipient is indicated.

Destruction

§ 10. (1) If EU classified information is no longer required, they shall be destroyed by means of appropriate procedures in accordance with DIN 66399. EU classified information subject to registration shall be destroyed exclusively by the registrar on the instruction of the registrar.

(2) The destruction shall be subject to a non-protocol protocol which shall be kept in place of the EU classified information. Audit minutes for EU classified information "Confidentiel UE/EU Confidential" and "Secret UE/EU Secret" are at least five years, non-compliance protocols for EU classified information " Très Secret UE/EU Top Secret " for at least ten years.

(3) The registrar responsible shall determine when an EU classified information is to be destroyed.

Service Instructions

§ 11. Appropriate service instructions shall, in particular, specify:

1.		administrative areas and particularly protected areas, as well as the management of the respective keys and codes,
2.		Samples for proof of security, the registration information, the acknowledgement of receipt and the non-registration protocol.

Control

§ 12. In any case, the information security system must be verifiably checked once in the calendar year. In case of a change of the registrar responsible, a complete inventory of the registry is to be carried out.

Prammer